Unified threat management (UTM) is a security product, usually a firewall appliance, that combines several protections in one box with one management console: firewalling, VPN, intrusion prevention, gateway antivirus, web filtering and often email filtering and application control. It sits at the edge of a site’s network and inspects traffic going in and out. UTM became popular with small and mid-sized businesses because it replaced several separate products with one.
At a glance
- A UTM is an all-in-one network firewall with added security features, managed from one console.
- It is most often a hardware appliance at each site; virtual and cloud-managed versions also exist.
- Turning on more features lowers throughput, so sizing should be based on the features you’ll actually use.
- Security features usually depend on a recurring subscription for signatures, categories and support.
- The line between UTM and next-generation firewalls has largely disappeared; compare products on features, not labels.
What problem it solves
A small office needs a firewall, remote access, protection from malware and some control over which websites people visit. Buying and managing a separate product for each takes money, time and expertise that a small IT team rarely has. UTM puts those functions in one device, with one vendor, one console and one support contract.
That consolidation is the appeal and the trade-off. It is simpler to buy and run, but everything depends on one box: if it fails or is overloaded, both security and connectivity at the site suffer, which is why many businesses pair appliances for high availability at important sites.
How it works
The UTM sits between the site’s network and its internet connection, so all traffic in and out passes through it.
- Firewall rules allow or block traffic by address, port, protocol and, on most current products, application and user.
- Intrusion prevention compares traffic against signatures and behavior patterns of known attacks and blocks matches.
- Gateway antivirus scans files passing through, such as downloads and email attachments.
- Web filtering blocks sites by category or reputation, often with TLS inspection so encrypted traffic can be examined.
- VPN provides site-to-site tunnels and remote access for users.
- Central management and logging let an administrator configure all of this in one place and review alerts, often across several sites from a cloud console.
Each feature adds processing work. Vendor datasheets usually list throughput for basic firewalling and, separately, with threat protection features on; the second figure is the one that matters for sizing.
When it matters for buyers
- When an office firewall reaches end of life or end of support. Compare a like-for-like UTM refresh with FWaaS or SASE for that site.
- When opening a small office. A UTM is a common way to get firewall, VPN and filtering in one purchase.
- When the network slows after enabling security features. The appliance may be undersized for the features in use.
- When renewing security subscriptions. Check what stops working if a subscription lapses and whether bundles include features you don’t use.
- When consolidating vendors. UTM reduces products at each site, but adds dependence on one vendor and one device.
Questions to ask vendors
- What is the throughput with the security features we plan to enable, including TLS inspection?
- Which features are included in the base subscription, and which cost extra?
- What happens to protection if the subscription lapses?
- How do you support high availability, and what does a second appliance cost?
- Can we manage multiple sites from one console, and is that cloud-based?
- How long will this model receive firmware and security updates?
How it differs from a next-generation firewall
The term next-generation firewall (NGFW) was coined for firewalls that identify applications and users, rather than only ports and addresses, and integrate intrusion prevention, aimed at larger organizations. UTM grew up in the small-business market as a bundle of many features in one box. Today many firewall products do both, and vendors use the labels inconsistently, so a “UTM” and an “NGFW” from the same vendor may run the same software. Firewall as a service (FWaaS) delivers similar controls from the cloud instead of an appliance, and is often part of SASE. For placement and sizing guidance, see our Network Firewalls overview.
Problems this helps with
- Small IT team can't run separate security products at every site
- Need firewall, web filtering and VPN for a small office from one vendor
- Office firewall slows to a crawl when security features are turned on
